Entra Id (Microsoft) - vulnerabilities (CVEs)
14 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-09-08. Vendor: Microsoft.
CVEs of Entra Id
- CVE-2026-83941 - CVSS 9.9 (critical), 2026-09-08: Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
- CVE-2026-62916 - CVSS 9.8 (critical), 2026-09-03: Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69836 - CVSS 10 (critical), 2026-08-20: Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
- CVE-2026-69851 - CVSS 9.9 (critical), 2026-08-20: Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
- CVE-2026-62869 - CVSS 8.8 (high), 2026-08-11: Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.
- CVE-2026-42901 - CVSS 10 (critical), 2026-05-22: Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-33843 - CVSS 9.8 (critical), 2026-05-22: Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a…
- CVE-2026-40379 - CVSS 9.3 (critical), 2026-05-12: Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-35431 - CVSS 10 (critical), 2026-04-23: Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-24305 - CVSS 9.8 (critical), 2026-01-22: Azure Entra ID Elevation of Privilege Vulnerability
- CVE-2025-59246 - CVSS 9.8 (critical), 2025-10-09: Azure Entra ID Elevation of Privilege Vulnerability
- CVE-2025-59218 - CVSS 9.6 (critical), 2025-10-09: Azure Entra ID Elevation of Privilege Vulnerability
- CVE-2025-55241 - CVSS 10 (critical), 2025-09-04: Azure Entra ID Elevation of Privilege Vulnerability
- CVE-2024-43477 - CVSS 7.5 (high), 2024-08-23: Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on…
